AI agents are blurring traffic, fraud and access governance

At a glance

What this is: Kasada's monthly threat intelligence update says AI agents are reshaping customer behaviour, adversary capability and fraud operations at the same time.

Why it matters: Identity, fraud and security teams now need controls that can tell legitimate agentic activity apart from automation abuse, because the same traffic patterns can represent either revenue or risk.

By the numbers:

• AI traffic rose 393% year over year in Q1 2026.
• AI traffic converted 42% more than regular customers in March 2026.
• The coding benchmark SWE-bench Verified went from 60% to nearly 100% in a single year.
• KasadaIQ tracked 13.2M verified, KYC and 2FA account sales in Q1.

Context

AI agents are no longer just a support channel or a fraud signal. They now sit inside the same customer journeys that retailers, marketplaces and banks rely on for discovery, evaluation and purchase, which means session behaviour is becoming harder to classify from the outside.

That creates a governance gap for identity and fraud teams: the same headless, programmatic or high-conversion pattern can belong to a legitimate shopper, an adversary automation stack or a brokered service laundering requests. AI agent authorisation matters here because access decisions are increasingly made at session and action level, not just at login.

The article also shows that AI capability growth is feeding directly into criminal tooling, while marketplace ecosystems are professionalising the supply chain around verification bypass and account abuse. That is now a mainstream control problem, not an edge-case anomaly.

Key questions

Q: How should security teams distinguish authorised AI agents from malicious bots?

A: Start by separating traffic classification from identity assurance. Device fingerprints and behavioural signals are useful, but they are not enough on their own when an AI agent can mimic legitimate workflows. Security teams should combine identity binding, policy context, and action sensitivity so they can tell whether the actor is permitted to perform the request, not just whether the request looks automated.

Q: Why do AI agents change fraud and identity risk so quickly?

A: Because they compress discovery, validation and action into one flow, which reduces the time defenders have to separate legitimate automation from abuse. At the same time, adversary tooling is getting easier to build and adapt. That combination raises both the volume and the realism of fraud, phishing and account takeover attempts.

Q: What are the signs that agentic traffic is being abused?

A: Look for unusually persistent sessions, high-conversion paths that still trigger support or recovery actions, and traffic that carries the shape of a legitimate referral but behaves like a scripted operation. The key sign is not automation alone. It is an interaction pattern that succeeds too well while still matching known abuse tactics.

Q: What should teams do after reservation or account data is exposed?

A: Assume the data will be turned into phishing, impersonation and account recovery abuse almost immediately. Tighten verification for support, reset high-risk credentials, monitor contact-channel abuse and raise suspicion thresholds for messages that exploit booking or account details. The aim is to reduce the credibility of the follow-on social engineering.

Technical breakdown

Why agent-shaped traffic breaks traditional session trust

Traditional bot detection often assumes that automated traffic is low intent, low conversion or easily distinguished from human browsing. That assumption breaks when AI assistants browse longer, convert better and sometimes arrive through legitimate discovery surfaces such as chat-based referral flows. The detection challenge is no longer simply “human or bot.” It is whether the session is a legitimate agent, a fraud automation layer or a brokered actor trying to blend into normal commerce. That forces security controls to look beyond device fingerprints and challenge-response friction toward request provenance, intent and transaction context. Read Zero Trust for AI Agents.

Practical implication: Treat session trust as a dynamic decision, not a one-time classification.

How marketplace professionalisation turns fraud into a service layer

The article describes Telegram-based guarantee marketplaces as escrow and coordination layers for laundering, compromised accounts, SIM cards, PII, malware and KYC bypass. That matters because the buyer is no longer assembling all capabilities in-house. Instead, threat operators purchase a packaged service chain that reduces friction, increases trust between criminal parties and scales repeatable abuse. In practical terms, the threat model shifts from isolated fraud events to an ecosystem that can source identity artefacts, abuse infrastructure and delivery channels on demand. Governance has to account for the whole chain, not just the final login attempt.

Practical implication: Map fraud controls to the supply chain that produces the abuse, not only to the endpoint transaction.

Why stronger models do not automatically mean safer automation

The article links frontier model gains to adversary infrastructure because coding and reasoning improvements reduce the skill required to build, adapt and operationalise offensive tooling. Better model performance does not just benefit legitimate assistants. It also lowers the barrier to entry for abuse automation, phishing variants, synthetic identity support and faster iteration on evasion. That creates a governance mismatch: security programmes often refresh controls on a slower cycle than the capability gains of the systems used to attack them. The operational answer is to govern what an automation can do, not just what model it uses.

Practical implication: Reassess control assumptions whenever model capability changes materially.

Threat narrative

Attacker objective: Exploit legitimate-looking AI-assisted sessions and brokered identity services to scale account abuse, fraud and social engineering while avoiding obvious bot detection.

1. Entry occurs when adversaries use AI-shaped traffic, compromised accounts or brokered marketplace services to blend into ordinary customer journeys.
2. Credential and trust material are then harvested through phishing, KYC bypass, account sales or other verification-brokered services that package access for downstream use.
3. Escalation happens when the same automation is used to launder requests, abuse stored value or scale phishing and account takeover across a larger target base.
4. Impact is fraud at scale, including account takeover, payment theft, reservation abuse and the conversion of legitimate AI traffic into an attack cover story.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI traffic is becoming an identity problem, not just a bot problem. When legitimate agents convert better than humans, session profiling alone stops being a reliable trust boundary. Security teams have to decide whether the actor behind the interaction is authorised for the transaction, not merely whether the browser looks automated. That is a direct identity governance issue for commerce and support workflows, especially where agentic sessions can purchase, compare or disclose on a user's behalf.

Professionalised fraud markets now behave like outsourced control planes. Dabai Guarantee is not just a marketplace for illegal services. It is a coordination layer that reduces friction between capability sellers and operators, which makes identity abuse more modular and more scalable. That changes the defender's problem from blocking one attack path to disrupting the service chain that assembles verification bypass and account compromise. Practitioners should treat these ecosystems as part of the threat infrastructure, not as background noise.

AI capability uplift is compressing the attacker skill curve. When frontier models approach human baselines on coding tasks, more offensive tooling can be produced, modified and operationalised by less skilled actors. The security implication is not that every model is malicious, but that offensive automation will iterate faster than many governance programmes can adapt. Teams need control logic that scales with capability, not a static set of abuse rules.

Customer journeys now contain a verification trust gap. Discovery, evaluation and validation increasingly happen inside a single conversational or referral flow, which makes the handoff between identity proof, session trust and transaction approval harder to govern. That creates a new class of risk where a session can look legitimate, act legitimately for part of the journey, and still be abusive at the decision point. Practitioners should design controls around the trust gap itself, not only around authentication.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Identity governance is moving closer to the transaction edge. As conversational and agentic sessions become normal, the decisive control is no longer just authentication at login but authorisation at the point of action. AI agent authorisation becomes the template for broader commerce and customer-journey governance, because the system has to decide what an actor may do in real time.

Verification trust gaps will become a primary fraud pattern. When discovery, evaluation and validation collapse into one interaction, defenders lose the easy separation between browsing and buying. That makes policy enforcement, step-up checks and downstream monitoring part of the same control plane rather than separate security activities.

Capability growth will keep outpacing static abuse rules. The faster AI systems get at coding and orchestration, the more quickly adversaries can adapt their tooling and packaging. Security programmes should assume the abuse ecosystem will iterate faster than manual rule updates, so control logic must be continuously re-tuned.

For practitioners

• Differentiate legitimate agents from abuse automation Instrument referral source, session cadence, transaction intent and downstream conversion so that agentic shoppers, scraping services and fraud tooling are not forced into the same policy bucket.
• Map fraud controls to brokered supply chains Track the services that enable compromise, including account markets, KYC bypass, SIM supply and laundering channels, then align monitoring and disruption to those dependencies.
• Rebaseline bot and fraud thresholds for agentic commerce Review rules that were tuned for low-conversion automation and update them for high-conversion, high-persistence sessions that may still be abusive.
• Harden post-breach identity verification Assume exposed customer data will be used in phishing, account recovery abuse and support impersonation, then tighten step-up checks and out-of-band confirmation paths.

Key takeaways

• AI-driven shopping and agent-shaped traffic are now part of normal commerce, which makes simple human-versus-bot assumptions less useful for access and fraud control.
• Criminal marketplaces are professionalising the services behind account compromise, KYC bypass and laundering, so defenders need to target the supply chain of abuse as well as the final attack.
• Security teams should rebaseline trust, verification and monitoring around real-time authorisation and post-breach abuse patterns rather than around static session heuristics.

Related NHI Mgmt Group resources: Zero Trust for AI Agents · AI Agent Observability, Audit and Incident Response Guide · AI Agent Authorisation Guide · Top 10 Agentic AI Identity Issues

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Verification Trust Gap: Verification trust gap is the difference between what an identity check claims and the level of trust a system can safely place in that result. In identity security, it appears when verification signals are incomplete, weak, stale, or easy to spoof, leaving IAM, NHI, and agentic AI decisions exposed to fraud or misuse.
• Brokered Abuse Economy: A criminal ecosystem where services, credentials, laundering, identity artefacts and bypass capabilities are bought and sold as modular components. This structure lowers the skill barrier for attackers and turns fraud into a supply-chain problem rather than a single-event problem.
• Agent-shaped Traffic: Network or session behaviour that looks like a legitimate AI assistant or automation layer because it uses structured browsing, high persistence or programmatic navigation. The challenge is that the same pattern can describe a valid customer journey or an abuse workflow, so context matters more than shape alone.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and machine identity security. It helps practitioners connect identity decisions to the broader security programme they operate.